Banned attachments?

Recently I'm getting error messages like this:

Our content checker found
banned name: P=p003,L=1,M=multipart/mixed | P=p002,L=1/2,M=application/msaccess,T=dat,N=myDb.mdb
in email presumably from you


I haven't consciously banned .mdb's or .zip's from being sended! Where can I lookup again which attachments have been banned? I can't find it in Apple's documentation ...

Thanks a lot.

Xserve Mac OS X (10.4.3)

Xserve, Mac OS X (10.4.3)

Posted on Feb 23, 2006 4:48 AM

Reply
13 replies

Feb 24, 2006 12:46 AM in response to Jerome Herr

I doubt this error message comes from your server. This is either a bounce message from an external receiving server generated by some mail believed to be sent by you (which isn't even necessarily true). Ignore, unless this is a mail sent by you that you want to reach destination. In that case notify recipient.

In a Tiger default installation no attachment checking by extension is done. This wouldn't make any sense. Extension can be changed and do not reveal whether an attachment is potentially dangerous or not. The best protection against "bad" attachments is still a virus scanner like ClamAV.

Alex

Feb 24, 2006 12:53 AM in response to pterobyte

Thanks, ptero.

But I tried it from several accounts actually. I also sent myself an e-mail with an .mdb attachment (to my work address and a freemail address) and I got the same error message!?

So the e-mails causing this error are valid. Not some junkmail using our addresses.

I also thought that the problem was on the receiver's side. But why should they deny an .mdb or .zip? I don't see a reason why Gmail for example should do that.

I'm experimenting some more to perhaps find the reason ... I'll keep this thread updated in case anyone's interested.

Feb 24, 2006 1:55 AM in response to pterobyte

Ok, I found the following:

$bannedfilenamere = new_RE(
qr'\.[a-zA-Z][a-zA-Z0-9]{0,3}\.(vbs|pif|scr|bat|com|exe|dll)$'i, # double ex$
qr'.\.(exe|vbs|pif|scr|bat|com)$'i, # banned extension - basic
qr'.\.(ade|adp|bas|bat|chm|cmd|com|cpl|crt|exe|hlp|hta|inf|ins|isp|js|
jse|lnk|mdb|mde|msc|msi|msp|mst|pcd|pif|reg|scr|sct|shs|shb|vb|
vbe|vbs|wsc|wsf|wsh)$'ix,


And there's the mdb indeed! But it must have been there by default. And we only recently noticed when somebody tried to send an .mdb for the first time.

So should I just delete it from that list?

Feb 24, 2006 2:10 AM in response to Jerome Herr

No it's not.
By default it is commented out (#), so you probably uncommented it at some point.

This what mine looks like:

$banned filenamere = new_RE(
qr'\.[a-zA-Z][a-zA-Z0-9]{0,3}\.(vbs|pif|scr|bat|com|exe|dll)$'i, # double extension
# qr'.\.(exe|vbs|pif|scr|bat|com)$'i, # banned extension - basic
# qr'.\.(ade|adp|bas|bat|chm|cmd|com|cpl|crt|exe|hlp|hta|inf|ins|isp|js|
# jse|lnk|mdb|mde|msc|msi|msp|mst|pcd|pif|reg|scr|sct|shs|shb|vb|
# vbe|vbs|wsc|wsf|wsh)$'ix, # banned extension - long
# qr'^\.(exe|zip|lha|tnef)$'i, # banned file(1) types
# qr'^application/x-msdownload$'i, # banned MIME types
# qr'^message/partial$'i, qr'^message/external-body$'i, # rfc2046
);

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Banned attachments?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.